firewall using wrong LDAP attribute to find user in active directory

Carracido — Fri, 12 Jul 2019 20:43:54 GMT

Hello Community,

I´d like to check with you the following issue:

created a LDAP authentication profile which is not working, when using the "test.... " command I get an authentication failed with "Received empty DN for user User12345"

I made a traffic capture and saw that the firewall is using the wrong attribute to find the user on the active directory. The firewall is using the "uid" attribute to authenticate the user but PAN firewalls can use only the following login attributes for LDAP authentication:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClogCAC

If I have the "sAMAccountName" login attribute in my authentication profile, why is the firewall even trying to search the active directory with "uid" attribute? Any idea?

Thank you,

Carracido.

Re: firewall using wrong LDAP attribute to find user in active directory

Remo — Sun, 28 Jul 2019 08:54:26 GMT

Hi @Carracido

Is your LDAP server profile configured correctly? Do you use the LDAP profile also for User-ID group mapping settings and if yes, does it work there correctly? Did you set the type to active-directory?

topic Re: firewall using wrong LDAP attribute to find user in active directory in General Topics

firewall using wrong LDAP attribute to find user in active directory

Re: firewall using wrong LDAP attribute to find user in active directory